Microsoft Windows Activex Controls Atl "oleloadfromstream()" Vulnerability

[Peaches]

Microsoft Windows ActiveX Controls ATL "OleLoadFromStream()" Vulnerability

Extremely critical

Description:

A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious people to bypass certain security restrictions and compromise a user's system.

The vulnerability is caused due to multiple ActiveX controls using the "OleLoadFromStream()" ATL function in an unsafe manner.

This is related to vulnerability #2 in:

SA35967 - http://secunia.com/advisories/35967/

Successful exploitation allows execution of arbitrary code.

NOTE: This vulnerability is reportedly being actively exploited.

OS -

Microsoft Windows 2000 Advanced Server

Microsoft Windows 2000 Datacenter Server

Microsoft Windows 2000 Professional

Microsoft Windows 2000 Server

Microsoft Windows 7

Microsoft Windows Server 2003 Datacenter Edition

Microsoft Windows Server 2003 Enterprise Edition

Microsoft Windows Server 2003 Standard Edition

Microsoft Windows Server 2003 Web Edition

Microsoft Windows Server 2008

Microsoft Windows Storage Server 2003

Microsoft Windows Vista

Microsoft Windows XP Home Edition

Microsoft Windows XP Professional

Secunia advisories - http://secunia.com/advisories/36997/